[antoinetoussaint-byte]

Closes #11.

Summary

• Moves the Core pin from v0.3.31 to v0.3.41, the version every codefly service agent was re-released against under Roll out core v0.3.41 across CLI, agents, saas-starter, modules and lodestar — the un-pinning sequence after #589 core#598. go.mod and go.sum only — no source change, and none of the API moves that hit the service agents on this jump reach this repo (no SBOMImages call, no ValidateCoverage, no ExpectedFromBuildPlan, no recoveryscope marker).
• The reason this bump is load-bearing rather than routine is that it crosses v0.3.39, where core's agents/contract package first shipped. An agent does not write its own contract declaration: the standard interceptor chain fills it in, at agents/agents.go:446 → agents/container_recovery.go:28, which sets advertisement.Contract = contract.Current() when the handler leaves it nil. main.go:42 calls agents.Serve, so this agent is on that chain. Verified both ends in the module cache: agents/contract exists at v0.3.41 and does not exist at v0.3.31, where there is also no contract.Current() call anywhere under agents/. Before this bump this agent advertised no wire contract; after it, it declares one.
• Transitively pulled by the same go mod tidy: grpc 1.83.1→1.83.2, otelgrpc 0.70.0→0.71.0, golang.org/x/{net,term,text} and genproto/googleapis/rpc. Nothing else was touched.

The release-path question in #11 — tracked in #12, not answered here

#11 asks whether this repo has a release path at all. Confirmed in this worktree that it does not: git tag -l is empty, .github/workflows/ contains only ci.yml, and agent.codefly.yaml declares version: 0.0.1 with nothing that publishes it.

That half is deliberately not settled in this PR. It is now #12, a sub-issue of umbrella #1, whose last open non-delegated checklist line it is. Filed by the #1 session rather than by me so the two sessions did not file it twice; it re-verified the three facts independently before filing, including zero tags via git ls-remote --tags origin and not just locally. This PR stays the clean bump.

Why it matters and should not be papered over by hand-tagging: because the contract declaration is compiled into the binary by the interceptor above, it reaches a consumer only through a published build. If this repo is ever resolved as a published artifact, merging this bump to main advertises nothing — precisely the failure mode that got the 17 service artifacts rejected in the core#598 rollout. So the question #12 leads with is whether this repo is consumed from source or as a published artifact; a missing releaser.yml is only the answer to one branch of it. It also carries the unchecked 0.0.1 ↔ v0.0.1 manifest/tag coupling (codefly-dev/cli#758), which a releaser.yml landing here would otherwise inherit from day one.

Test plan

Full CI triple, run locally with GOWORK=off, all clean on this branch:

• go build ./... — clean
• go vet ./... — clean
• go test ./... — all three packages pass:
  runnable-go 122.5s, pkg/agent 1.3s, pkg/generate 104.8s
• Goldens unchanged — pkg/generate's golden comparison passes without UPDATE_GOLDEN, so generated output is byte-identical across the bump.
• The suite's real boundaries all exercised by the above, not mocked: serve_test.go builds the agent binary and speaks gRPC to it, pkg/generate/compile_test.go compiles generated packages with the real toolchain under GOPROXY=off, and pkg/generate/invocation_test.go runs a built harness as a process.

Not verified: that a published build of this agent is accepted by a consumer — this repo publishes nothing today, which is exactly what #12 tracks. The contract wiring is verified by source inspection of the linked core and by the agent taking agents.Serve, not by observing a live handshake.

🤖 Generated with Claude Code